CVE-2023-27076: Tenda G103 Firmware RCE Vulnerability

CVE-2023-27076 Overview

CVE-2023-27076 is a command injection vulnerability affecting Tenda G103 routers running firmware version 1.0.0.5. The flaw resides in the handling of the language parameter, which is passed to a system shell without proper sanitization. Remote attackers can inject arbitrary operating system commands through this parameter and execute them with the privileges of the router's web service.

The vulnerability is classified under CWE-78, Improper Neutralization of Special Elements used in an OS Command. Successful exploitation results in arbitrary code execution on the affected device.

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands on Tenda G103 routers, leading to full device compromise, traffic interception, and use of the router as a pivot into internal networks.

Affected Products

Tenda G103 Firmware version 1.0.0.5
Tenda G103 hardware appliance
Deployments exposing the G103 web management interface to untrusted networks

Discovery Timeline

2023-04-10 - CVE-2023-27076 published to NVD
2025-05-05 - Last updated in NVD database

Technical Details for CVE-2023-27076

Vulnerability Analysis

The Tenda G103 web management interface accepts a language parameter used to configure the locale of the administration UI. The handler concatenates the supplied value into a shell command without input validation or argument escaping. Attackers append shell metacharacters such as ;, |, or backticks to inject additional commands.

Because the affected service runs with elevated privileges on the embedded Linux operating system, injected commands execute as a privileged user. The attack requires no authentication and no user interaction, and it is reachable over the network wherever the management interface is exposed.

The EPSS score is 8.387% at the 92.392 percentile, indicating elevated likelihood of exploitation attempts relative to the broader CVE population. A public proof-of-concept is documented in the referenced GitHub repository.

Root Cause

The root cause is missing input neutralization on the language parameter before it is passed to an system()-style shell invocation. The web handler trusts client-supplied locale values and embeds them directly into a command string. Any shell metacharacter in the parameter is interpreted by the shell rather than being treated as data.

Attack Vector

The attack is delivered over the network through an HTTP request to the router's web management endpoint. An attacker sets the language parameter to a payload containing shell metacharacters followed by arbitrary commands. The injected command runs in the context of the web service on the device.

No verified exploit code is published in vendor or CNA references. Technical details and request structure are described in the GitHub PoC Repository.

Detection Methods for CVE-2023-27076

Indicators of Compromise

HTTP requests to the G103 management interface containing shell metacharacters such as ;, &&, |, or backticks within the language parameter
Outbound connections from the router to unknown hosts after receipt of a crafted management request
Unexpected modifications to router configuration, DNS settings, or firmware
New or unfamiliar processes running on the device, where shell access is available

Detection Strategies

Inspect web server and reverse proxy logs for language= values containing non-alphabetic characters or URL-encoded shell metacharacters
Apply network IDS signatures that flag command injection payload patterns directed at Tenda management endpoints
Monitor DNS queries originating from the router's WAN IP for anomalies consistent with command-and-control activity

Monitoring Recommendations

Forward router and perimeter logs to a centralized SIEM and alert on suspicious parameter values targeting embedded device interfaces
Baseline the router's normal outbound traffic and alert on deviations such as new destinations, ports, or protocols
Track firmware version and configuration drift across the fleet of Tenda devices

How to Mitigate CVE-2023-27076

Immediate Actions Required

Restrict access to the Tenda G103 web management interface to trusted internal management networks only
Disable remote WAN-side administration on all G103 devices
Rotate administrative credentials and review router configuration for unauthorized changes
Audit devices for signs of compromise such as altered DNS settings, new firewall rules, or unknown firmware

Patch Information

No vendor advisory or fixed firmware version is referenced in the NVD entry for CVE-2023-27076. Organizations should monitor the Tenda support site for firmware updates addressing the language parameter handling and apply them as soon as they become available.

Workarounds

Place affected G103 devices behind a network segment that blocks untrusted access to TCP ports used by the management interface
Use an upstream firewall to drop HTTP requests containing shell metacharacters in query strings destined for the router
Where feasible, replace end-of-support or unpatched devices with hardware that receives active security maintenance

bash

# Example: restrict access to the G103 management interface to a management subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP